CommSec D1 - A Deep Dive Into Malicious Documents
summary
Step‑by‑step techniques for dissecting maldocs: use Oledump to list streams and extract userform blobs that store ASCII‑encoded PE bytes, open the project in the Office IDE to set breakpoints and debug VBA, and recover staged shellcode by tracing imports like VirtualAlloc/EnumDateFormats callback plus RTLMoveMemory to allocate RWX and execute. Examples include macros that base64 PowerShell stages, certutil writing a PFX as an EXE, process‑hollowing style shellcode staging, and a simple OSX reverse shell that uses /bin/sh and stdio redirection.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 2:19How malicious documents work
- 7:39Inspecting macros with tools
- 11:17Social engineering tactics
- 15:31Obfuscation techniques in macros
- 18:00Windows API abuse in VBA
- 20:46PowerShell integration in macros
- 22:54Non-macro malicious documents
- 24:59Cross-platform attack methods
related talks
51mOffice in Wonderland
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
43mHunting for Bugs, Catching Dragons
45m"Advanced Malware Threat: handling obfuscated code using..."
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
48m"Sneaking Past Device Guard"
01h 03mEffects Malware hunting in Cloud environment
01h 06mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)